What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A password manager gives you a repeatable way to replace reused passwords with long, random, unique credentials. You create one strong master passphrase for the manager, protect the vault with multi-factor authentication (MFA), let the manager generate a different password for every account, and use its app or browser extension to save and fill those credentials. Before choosing a service, check that it works on all your devices, understand whether it uses cloud or local storage, verify its recovery process, and review the developer’s security information.
The practical sequence is: choose a suitable manager; secure the manager account; import or create each login; generate and save a unique password; install the manager everywhere you sign in; turn on MFA for important accounts; and test recovery before an emergency.
What a password manager does
A password manager is an app or service that keeps account credentials in a protected vault. Instead of memorizing dozens of passwords, you remember the manager’s master passphrase and use the manager to retrieve the rest. Its generator can create long, random passwords that are different for every site, reducing the damage if one service’s password is exposed.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →NIST highly recommends password managers for accounts that require passwords and recommends MFA for the manager login. Its consumer guidance, updated August 20, 2025, also explains that passkeys can avoid memorized passwords and are not easily stolen through phishing: NIST’s password guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The manager does not make every account safe by itself. Someone who obtains your master credential may gain access to the vault, and an attacker can still target an individual account through phishing, malware, or a stolen session. Treat the vault as a high-value account and add MFA to important services as well.
Choose a manager before creating passwords
Do not begin by installing the first app you see. Selection determines whether you can use the vault reliably and recover it when a phone, computer, or credential is lost. CISA’s password-manager guidance recommends evaluating the following dimensions.
| Selection question | What to verify | Why it matters |
|---|---|---|
| Does it cover your devices? | Check support for every operating system, browser, and phone you actually use. Confirm that the app or extension is still maintained. | A vault that works only on one device encourages copying passwords or reusing them elsewhere. |
| Where is the vault stored? | Determine whether credentials synchronize through a provider’s cloud service, remain in a local database, or can use both approaches. | Cloud storage simplifies access across devices; local storage gives you more direct control but requires disciplined backups. |
| How does recovery work? | Read the documented process for a lost device, forgotten master passphrase, or unavailable recovery method. Find out whether recovery is possible at all. | A recovery design affects whether you can regain access and whether another person could reset the vault. |
| What MFA options are available? | Look for authenticator-app codes, passkeys, security keys, or other factors, and check which are supported for the manager account itself. | MFA adds a separate proof of identity if the master password is exposed. |
| Who develops it? | Review the company’s security documentation, update history, incident disclosures, and privacy terms. Download only from the official app store or developer site. | You are entrusting the provider with software that handles your most sensitive credentials. |
| Will it work on your regular sites? | Check whether the browser extension and mobile app can fill the logins, handle passkeys where offered, and cope with your commonly used applications. | Convenient, reliable use is what prevents fallback to insecure notes or memory. |
Secure the manager account first
Create a memorable master passphrase
During setup, create the secret that unlocks your vault. Make it long enough to resist guessing and memorable enough that you do not need to write it beside your computer. A passphrase made from several unrelated words is easier to remember than a short string of substitutions. Do not use a phrase that appears in public profiles, a quotation associated with you, or a password used anywhere else.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsNIST’s digital-identity FAQ discusses using a long master passphrase and the benefits and risks of a password vault: NIST SP 800-63 FAQ. The manager’s master secret is the exception to the “let the generator handle it” rule: you normally must know it, so practice entering it before you rely on the vault.
Turn on MFA for the vault
Open the manager’s account or security settings and enable the strongest practical second factor. An authenticator app, a passkey, or a physical security key may be available, but support varies by product. CISA describes a physical security key as one example of an MFA factor in its cybersecurity essentials guidance. A key is optional; verify compatibility with both the manager and the accounts you want to protect.
Register a backup factor if the service permits it, and store recovery codes somewhere separate from the device used for login. Do not leave the only authenticator on a phone that you might lose without a way to restore it.
Learn recovery before you need it
Read the manager’s recovery instructions while you are still signed in. Determine whether a forgotten master passphrase can be reset, whether recovery requires a previously trusted device, and whether the provider can access any vault data. Some designs deliberately cannot recover a forgotten vault secret; that can reduce provider access but makes your own backup planning critical.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Record the recovery method in a secure offline location.
- Keep backup MFA codes where a lost phone cannot destroy your only access path.
- Test signing in on a second device before deleting the original setup.
- Never email the master passphrase or store it in an unprotected text file.
Create a unique password for each account
Start with one account at a time
Sign in to the account, open its password or security settings, and choose the option to change the password. Open the manager’s generator from the browser extension, app, or password field. Labels differ by product, but the controls usually include length, letters, numbers, symbols, and sometimes a memorable passphrase mode.
- Identify the exact login entry in the manager, such as the account’s domain and username.
- Generate a password using the longest length the site accepts. Prefer a random result rather than editing it into a familiar word.
- Check that the site accepts the generated characters. If it rejects a symbol, adjust the generator’s format and create a new password instead of deleting characters manually.
- Submit the change on the site.
- Save or update the matching manager entry immediately, including the correct username and sign-in address.
- Sign out and sign back in once to confirm that the saved credential works.
CISA describes the target as long, random, and unique, and NIST explains that managers can generate and securely store long, complex, unique passwords. Use a different generated password for every account, including accounts belonging to the same company or service family.
Handle existing reused passwords safely
Make an inventory of accounts whose passwords are reused, short, or old. Change the most sensitive accounts first: email, financial services, cloud storage, work systems, and the manager itself. After changing one, mark the entry as updated in the manager or in a temporary checklist that you will delete when finished. Never put the inventory in a publicly synced document.
If a site does not offer a password-change page, use its account-recovery flow or contact its support channel. Do not keep using a reused password merely because the site’s settings are inconvenient.
Install the manager on every device you use
Desktop browsers
Install the official desktop application if the service provides one, then add its browser extension from the browser’s approved extension store. Sign in to the extension, approve the requested permissions after reviewing them, and lock the extension when you step away. On a shared computer, use a separate operating-system account or avoid unlocking the vault there.
Phones and tablets
Install the official mobile app, sign in, and enable the platform’s biometric unlock only if the device itself is protected by a strong screen lock. Turn on synchronization only after confirming which vault is the source of truth. Test filling a login in a normal browser and in one or two important apps; some apps require choosing the manager from the keyboard or an “Autofill” setting.
New or replacement devices
Before wiping an old device, verify that the vault opens on the new one and that your MFA method works there. Revoke the old device from the manager’s account page when it is sold, lost, or no longer under your control.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use autofill without weakening the password
When a login form appears, open the manager’s extension or mobile autofill prompt and select the matching entry. Confirm the domain and username before filling; a look-alike domain can be a phishing site. Let the manager insert the generated password rather than shortening it so it is easier to type.
Some sites interfere with browser extensions, split a login across several pages, or place fields inside an embedded application. Try the manager’s copy-and-paste command only after confirming the site address, then clear the clipboard if your operating system offers a clear option. Do not leave a password in a chat, document, screenshot, or browser note.
NIST SP 800-63B states: “SHOULD permit claimants to use the ‘paste’ function when entering a password to facilitate password manager use when password autofill APIs are unavailable.” The same standard says services should support at least 64 characters, accept spaces, encourage length, and avoid additional character-composition rules. Those are requirements and recommendations for websites and other verifiers, not settings you must enable in the manager: NIST SP 800-63B.
Decide between cloud synchronization and a local vault
Storage is a design choice rather than a universally correct answer. Compare the consequences before importing your credentials.
| Approach | Advantages | Responsibilities and risks | Best fit |
|---|---|---|---|
| Cloud-synchronized vault | Convenient access on multiple devices; changes can synchronize automatically; a device failure does not necessarily remove the only copy. | Vault data travels over the internet and is stored on a provider’s server outside your direct control. You must trust the provider, protect the account, and keep recovery factors available. | People who use several devices and value simple synchronization. |
| Locally maintained vault | The database remains under your direct control and avoids dependence on a provider’s online synchronization service. | You must create regular backups on separate media, keep compatible software available, and solve synchronization between devices yourself. Losing the database and its backups can mean losing access. | People comfortable maintaining files, backups, and manual device access. |
CISA highlights these cloud-versus-local trade-offs and does not prescribe one universal choice. A local file is not automatically safer if it has no tested backup, while a cloud vault is not automatically safer if its account recovery and MFA are neglected.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build a backup plan
For a local vault, make periodic backups to at least one separate medium and protect the backup as carefully as the primary database. Keep a copy away from the computer that could be stolen or damaged. For a cloud vault, confirm what export or emergency-access options exist and whether an export would be unprotected; delete temporary exports after storing them securely.
Schedule a recovery check: open a backup or sign in on a secondary device, verify that recent entries are present, and then lock the device again. A backup that has never been restored is only an assumption.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Add MFA and passkeys to important accounts
A unique password limits reuse, but it does not stop phishing or a stolen session. Open each high-value account’s security settings and enable MFA. An authenticator app, a passkey, or a hardware security key may be offered; choose an option you can maintain and keep a backup method where the service supports one.
NIST notes that passkeys do not require memorization and are not easily stolen through phishing. When a service offers a passkey, enroll it through the service’s official security page and confirm how you will recover it if a device is lost. Keep the password manager for accounts that still require passwords; passkeys and passwords can coexist.
Recommended Free Tools
Common problems and practical fixes
The generated password is rejected
Check the site’s stated maximum length and allowed characters. Reopen the generator, set a compatible format, and create a new password. Do not remove random characters from an already generated password and then reuse that shortened result elsewhere.
Autofill selects the wrong login
Inspect the saved domain, username, and sign-in URL. Edit or delete duplicate entries, and avoid allowing autofill on an unfamiliar domain. If the site uses several subdomains, save the precise addresses required by its official login flow.
The phone cannot find the manager
Confirm that the manager is enabled under the phone’s password or autofill provider settings, then update the app and restart the browser. For an app that does not expose an autofill interface, open the manager, copy the username and password separately, paste them into the confirmed login screen, and clear the clipboard afterward.
You lost the device with the authenticator
Use a registered backup factor or recovery code, sign in from a trusted device, and revoke the lost device. If no recovery route works, follow the manager’s documented account-recovery process; do not create a second vault and assume it contains the old credentials.
You forgot the master passphrase
Stop guessing repeatedly, because some services can trigger lockouts. Consult the recovery instructions you reviewed during setup. If the design cannot reset the vault secret, restore a verified backup or rebuild the affected logins through each service’s account-recovery process.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A maintenance routine that keeps the vault useful
- When creating an account, generate and save its unique password immediately.
- When changing an email address or username, update the corresponding manager entry at the same time.
- Review the manager’s security dashboard or account list for duplicate, reused, or exposed credentials if the product provides such a feature.
- Remove entries for closed accounts and delete old exports.
- Install manager and browser updates from official sources.
- After a phone, computer, or browser extension is retired, revoke its access from the manager account.
- Periodically confirm that your backup MFA method and recovery codes still work.
Following this routine means the manager remains a working access system rather than an abandoned list of old passwords.
Frequently Asked Questions
How do I create a good password?
For an account that still uses passwords, have the manager generate a long, random password and save it directly to that account’s entry. Use a different generated password for every account and keep the master passphrase separate from all of them.
How does a password manager work if I use more than one device?
Install the manager’s official app or browser extension on each device, sign in using the manager’s account and MFA, and enable the selected synchronization method. Test a login on the new device before removing the old one.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteShould I store my vault in the cloud or locally?
Cloud synchronization is easier across devices but places data on a provider’s server and requires trust in its recovery and security controls. A local vault offers more direct control but requires separate, tested backups and more maintenance. Choose according to your devices, trust model, and backup habits.
Can a password manager replace MFA?
No. It prevents password reuse and helps create strong credentials, but MFA or a passkey adds another protection against phishing and stolen passwords. Enable MFA or passkeys on the manager and on important accounts when supported.
What if a website blocks autofill?
Verify the domain, use the manager’s copy-and-paste function if necessary, and clear the clipboard afterward. NIST SP 800-63B says services should permit paste when autofill APIs are unavailable, support passwords of at least 64 characters, accept spaces, and avoid extra composition rules.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
